code-423n4 / 2021-10-slingshot-findings

0 stars 0 forks source link

The `Slingshot::_transferFromOrWrap` function should require a `msg.value` of 0 if `fromToken != nativeToken` #52

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

pmerkleplant

Vulnerability details

The _transferFromOrWrap function in Slingshot.sol should require msg.value == 0 if fromToken != nativeToken, see line 150 for missing check.

Otherwise, the user will lose the native tokens and they would need to be manually rescued by Slingshot's admin through the rescueTokens function.

tommyz7 commented 2 years ago

Duplicate of #95